Next: , Up: weird Analysis Script


7.27.1 Actions for “weird” events

The general approach taken by the module is to categorize for each event the action to take when the event engine generates the event. Table XX summarizes the different possible actions.

Action Meaning
WEIRD_UNSPECIFIED No action specified.
WEIRD_IGNORE Ignore the event.
WEIRD_FILE Record the event to weird file, if it has not been seen for these hosts before. (But see weird do not ignore repeats.)
WEIRD_NOTICE_ALWAYS Record the event to weird file and generate a notice each time the event occurs.
WEIRD_NOTICE_ONCE Record the event to weird file; generate a notice the first time the event occurs.
WEIRD_NOTICE_PER_CONN Record the event to weird file; generate a notice the first time it occurs for a given connection.
WEIRD_NOTICE_PER_ORIG Record the event to weird file; generate a notice the first time it occurs for a given originating host.

Table 7.9: Different types of possible actions to take for "weird" events